Strict mode
Strict mode is an organisation policy for teams that want the tightest possible handling of keys on devices. It’s off by default.
What it changes
Section titled “What it changes”Normally, when you unlock your identity key on a browser, it’s cached there (in non-extractable form) so you don’t have to unlock again on that device. With strict mode on:
- Identity keys are never cached on a device. An unlocked key is held only in the open page’s memory and is gone as soon as you reload or close SafeHanded.
- So you unlock again on every fresh visit before you can reveal, and every reveal still asks for a passkey confirmation as usual.
The result: no device keeps a decryptable key at rest, and a key is only usable while you’re in the app with it unlocked.
Who it’s for
Section titled “Who it’s for”Strict single teams and regulated environments that prefer unlocking on every visit over the convenience of a cached key. It pairs naturally with keeping the organisation recovery key off for a pure zero-escrow posture.
What it requires of technicians
Section titled “What it requires of technicians”Because there’s no cached key to fall back on, technicians unlock far more often. A PRF-capable passkey makes that one touch; without one, they have to type their 24-word recovery phrase each time, which isn’t practical day to day. Check passkey compatibility before turning strict mode on for the whole org.
Turning it on
Section titled “Turning it on”An Owner or Admin turns on Strict mode in Settings → Policy, under Reveal, and saves. See Setting your policy for where it sits alongside link lifetimes and verification requirements.